OWASPASVS 5.0 requirement
ASVS-V10.2.3 The oauth client only requests the required scopes (or other authorization parameters) in requests to the authorization server.
- Standard
- OWASP ASVS 5.0
- Chapter
- V10 OAuth and OIDC
- Section
- V10.2 OAuth Client
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that the OAuth client only requests the required scopes (or other authorization parameters) in requests to the authorization server.